@@ -50,9 +50,6 @@ const (
5050 ctMarkOVN = "0x1"
5151 // ctMarkHost is the conntrack mark value for host traffic
5252 ctMarkHost = "0x2"
53- // ovnkubeSvcViaMgmPortRT is the number of the custom routing table used to steer host->service
54- // traffic packets into OVN via ovn-k8s-mp0. Currently only used for ITP=local traffic.
55- ovnkubeSvcViaMgmPortRT = "7"
5653 // ovnKubeNodeSNATMark is used to mark packets that need to be SNAT-ed to nodeIP for
5754 // traffic originating from egressIP and egressService controlled pods towards other nodes in the cluster.
5855 ovnKubeNodeSNATMark = "0x3f0"
@@ -2169,62 +2166,6 @@ func setBridgeOfPorts(bridge *bridgeConfiguration) error {
21692166 return nil
21702167}
21712168
2172- // initSvcViaMgmPortRoutingRules creates the svc2managementport routing table, routes and rules
2173- // that let's us forward service traffic to ovn-k8s-mp0 as opposed to the default route towards breth0
2174- func initSvcViaMgmPortRoutingRules (hostSubnets []* net.IPNet ) error {
2175- // create ovnkubeSvcViaMgmPortRT and service route towards ovn-k8s-mp0
2176- for _ , hostSubnet := range hostSubnets {
2177- isIPv6 := utilnet .IsIPv6CIDR (hostSubnet )
2178- gatewayIP := util .GetNodeGatewayIfAddr (hostSubnet ).IP .String ()
2179- for _ , svcCIDR := range config .Kubernetes .ServiceCIDRs {
2180- if isIPv6 == utilnet .IsIPv6CIDR (svcCIDR ) {
2181- if stdout , stderr , err := util .RunIP ("route" , "replace" , "table" , ovnkubeSvcViaMgmPortRT , svcCIDR .String (), "via" , gatewayIP , "dev" , types .K8sMgmtIntfName ); err != nil {
2182- return fmt .Errorf ("error adding routing table entry into custom routing table: %s: stdout: %s, stderr: %s, err: %v" , ovnkubeSvcViaMgmPortRT , stdout , stderr , err )
2183- }
2184- klog .V (5 ).Infof ("Successfully added route into custom routing table: %s" , ovnkubeSvcViaMgmPortRT )
2185- }
2186- }
2187- }
2188-
2189- createRule := func (family string ) error {
2190- stdout , stderr , err := util .RunIP (family , "rule" )
2191- if err != nil {
2192- return fmt .Errorf ("error listing routing rules, stdout: %s, stderr: %s, err: %v" , stdout , stderr , err )
2193- }
2194- if ! strings .Contains (stdout , fmt .Sprintf ("from all fwmark %s lookup %s" , types .OVNKubeITPMark , ovnkubeSvcViaMgmPortRT )) {
2195- if stdout , stderr , err := util .RunIP (family , "rule" , "add" , "fwmark" , types .OVNKubeITPMark , "lookup" , ovnkubeSvcViaMgmPortRT , "prio" , "30" ); err != nil {
2196- return fmt .Errorf ("error adding routing rule for service via management table (%s): stdout: %s, stderr: %s, err: %v" , ovnkubeSvcViaMgmPortRT , stdout , stderr , err )
2197- }
2198- }
2199- return nil
2200- }
2201-
2202- // create ip rule that will forward ovnkubeITPMark marked packets to ovnkubeITPRoutingTable
2203- if config .IPv4Mode {
2204- if err := createRule ("-4" ); err != nil {
2205- return fmt .Errorf ("could not add IPv4 rule: %v" , err )
2206- }
2207- }
2208- if config .IPv6Mode {
2209- if err := createRule ("-6" ); err != nil {
2210- return fmt .Errorf ("could not add IPv6 rule: %v" , err )
2211- }
2212- }
2213-
2214- // lastly update the reverse path filtering options for ovn-k8s-mp0 interface to avoid dropping return packets
2215- // NOTE: v6 doesn't have rp_filter strict mode block
2216- rpFilterLooseMode := "2"
2217- // TODO: Convert testing framework to mock golang module utilities. Example:
2218- // result, err := sysctl.Sysctl(fmt.Sprintf("net/ipv4/conf/%s/rp_filter", types.K8sMgmtIntfName), rpFilterLooseMode)
2219- stdout , stderr , err := util .RunSysctl ("-w" , fmt .Sprintf ("net.ipv4.conf.%s.rp_filter=%s" , types .K8sMgmtIntfName , rpFilterLooseMode ))
2220- if err != nil || stdout != fmt .Sprintf ("net.ipv4.conf.%s.rp_filter = %s" , types .K8sMgmtIntfName , rpFilterLooseMode ) {
2221- return fmt .Errorf ("could not set the correct rp_filter value for interface %s: stdout: %v, stderr: %v, err: %v" ,
2222- types .K8sMgmtIntfName , stdout , stderr , err )
2223- }
2224-
2225- return nil
2226- }
2227-
22282169func newGateway (
22292170 nodeName string ,
22302171 subnets []* net.IPNet ,
@@ -2362,12 +2303,6 @@ func newGateway(
23622303 }
23632304
23642305 if config .Gateway .NodeportEnable {
2365- if config .OvnKubeNode .Mode == types .NodeModeFull {
2366- // (TODO): Internal Traffic Policy is not supported in DPU mode
2367- if err := initSvcViaMgmPortRoutingRules (subnets ); err != nil {
2368- return err
2369- }
2370- }
23712306 klog .Info ("Creating Gateway Node Port Watcher" )
23722307 gw .nodePortWatcher , err = newNodePortWatcher (gwBridge , gw .openflowManager , gw .nodeIPManager , watchFactory , networkManager )
23732308 if err != nil {
0 commit comments